THREAT MODELING FRAMEWORKS

Question 1

BELL LA PADULA MODEL

Question 2

BIBA MODEL

Question 3

GENERAL THREAT MODELING PRINCIPLES

Answer 3

PREPARATION
IDENTIFICATION
MITIGATIONS
REVIEW

Question 4

STRIDE

Answer 4

S-spoofing
T-tampering
R-repudiation
I-Information Disclosure
D-Denial of service
E-Elevation of privilege

Question 5

PASTA

Question 6

THREAT INTELLIGENCE

Question 7

ASSET IDENTIFICATION

Question 8

MITIGATION CAPABILITIES

Question 9

RISK ASSESSMENT

Question 10

SPOOFING

Answer 10

This principle requires you to authenticate requests and users accessing a system. Spoofing involves a malicious party falsely identifying itself as another.

Access keys (such as API keys) or signatures via encryption helps remediate this threat.

Question 11

TAMPERING

Answer 11

By providing anti-tampering measures to a system or application, you help provide integrity to the data. Data that is accessed must be kept integral and accurate.

For example, shops use seals on food products.

Question 12

REPUDIATION

Answer 12

This principle dictates the use of services such as logging of activity for a system or application to track.

Question 13

INFORMATION DISCLOSURE

Answer 13

Applications or services that handle information of multiple users need to be appropriately configured to only show information relevant to the owner.

Question 14

DENIAL OF SERVICE

Answer 14

Applications and services use up system resources, these two things should have measures in place so that abuse of the application/service won’t result in bringing the whole system down.

Question 15

CIA TRIAD

Answer 15

CONFIDENTIALITY
INTEGRITY
AVAILABILITY

Question 16

ELEVATION OF PRIVILEGE

Answer 16

This is the worst-case scenario for an application or service. It means that a user was able to escalate their authorization to that of a higher level i.e. an administrator. This scenario often leads to further exploitation or information disclosure.

Question 17

CONFIDENTIALITY

Question 18

INTEGRITY

Question 19

AVAILABILITY

Question 20

INCIDENT

Question 21

INCIDENT RESPONSE

Question 22

PHASES OF INCIDENT RESPONSE

Answer 22

PREPARATION
IDENTIFICATION
CONTAINMENT
ERADICATION
RECOVERY
LESSONS LEARNED

Question 23

PREPARATION

Answer 23

Do we have the resources and plans in place to deal with the security incident?

Question 24

IDENTIFICATION PHASE

Answer 24

Has the threat and the threat actor been correctly identified in order for us to respond to?

Question 25

CONTAINMENT PHASE

Answer 25

Can the threat/security incident be contained to prevent other systems or users from being impacted?

Question 26

ERADICATION PHASE

Answer 26

Remove the active threat.

Question 27

RECOVERY PHASE

Answer 27

Perform a full review of the impacted systems to return to business as usual operations.

Question 28

CRYPTOGRAPHIC FAILURE

Question 29

LESSONS LEARNED PHASE

Answer 29

What can be learnt from the incident? I.e. if it was due to a phishing email, employees should be trained better to detect phishing emails.

Question 30

IDOR